Why authorization matters in Django - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why is authorization important in a Django app?

Imagine a Django app where users can view and edit data. What is the main reason to use authorization?

A To control what actions each user can perform based on their role

B To speed up the loading time of pages

C To encrypt user passwords in the database

D To make the website look nicer with CSS

💡 Hint

Think about keeping data safe and limiting access.

Authorization ensures users only do what they are allowed to do, protecting data and app integrity.

❓ component_behavior

intermediate

What happens if a Django view lacks authorization checks?

Consider a Django view that shows user profiles but has no authorization. What is the likely outcome?

A The view will automatically block unauthorized users

B Any logged-in user can see all profiles, even those they shouldn't access

C The server will crash with an error

D Users will see a blank page

💡 Hint

Think about what happens when no rules limit access.

Without authorization, users can access data they shouldn't, risking privacy and security.

❓ state_output

advanced

What is the output of this Django authorization code snippet?

Given this Django view code, what will be the HTTP response status if a user without 'can_edit' permission tries to access it?

Django

from django.contrib.auth.decorators import permission_required
from django.http import HttpResponse

@permission_required('app.can_edit')
def edit_view(request):
    return HttpResponse('Edit page')

A 200 OK with 'Edit page' content

B 404 Not Found error

C 403 Forbidden error

D 500 Internal Server Error

💡 Hint

What does the decorator do when permission is missing?

The decorator returns 403 Forbidden if the user lacks the required permission.

📝 Syntax

advanced

Which Django authorization code correctly restricts access to staff users only?

Choose the code snippet that properly restricts a view to staff users.

A

from django.contrib.admin.views.decorators import staff_member_required

@staff_member_required
def staff_view(request):
    return HttpResponse('Staff only')

B

from django.contrib.auth.decorators import login_required

@login_required
def staff_view(request):
    if request.user.is_staff:
        return HttpResponse('Staff only')
    else:
        return HttpResponse('Access denied')

C

from django.contrib.auth.decorators import user_passes_test

def is_staff(user):
    return user.is_staff

@user_passes_test(is_staff)
def staff_view(request):
    return HttpResponse('Staff only')

D

def staff_view(request):
    if request.user.is_staff:
        return HttpResponse('Staff only')
    else:
        return HttpResponse('Access denied')

💡 Hint

Look for the built-in decorator designed for staff access.

@staff_member_required is the standard decorator that restricts access to staff users and redirects others.

🔧 Debug

expert

Why does this Django authorization check fail to block unauthorized users?

Review this Django view code. Why does it allow users without 'can_view' permission to access the page?

Django

def view_page(request):
    if request.user.has_perm('app.can_view'):
        pass
    return HttpResponse('Page content')

A The view lacks a login_required decorator

B The has_perm method is misspelled and always returns true

C The HttpResponse should be replaced with render()

D The permission check does nothing because the return is outside the if block

💡 Hint

Check where the return statement is placed in relation to the permission check.

The return statement is outside the if block, so the page always returns content regardless of permission.